CVE-2026-23295
Analyzed Analyzed - Analysis Complete
Deadlock Vulnerability in Linux accel/amdxdna During Suspend/Resume

Publication date: 2026-03-25

Last updated on: 2026-05-29

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix dead lock for suspend and resume When an application issues a query IOCTL while auto suspend is running, a deadlock can occur. The query path holds dev_lock and then calls pm_runtime_resume_and_get(), which waits for the ongoing suspend to complete. Meanwhile, the suspend callback attempts to acquire dev_lock and blocks, resulting in a deadlock. Fix this by releasing dev_lock before calling pm_runtime_resume_and_get() and reacquiring it after the call completes. Also acquire dev_lock in the resume callback to keep the locking consistent.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-25
Last Modified
2026-05-29
Generated
2026-06-16
AI Q&A
2026-03-25
EPSS Evaluated
2026-06-15
NVD
CVE-2026-23295
EUVD
EUVD-2026-15227
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
linux linux_kernel From 6.19 (inc) to 6.19.7 (exc)
linux linux_kernel 7.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-667 The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability occurs in the Linux kernel's amdxdna acceleration component. When an application issues a query IOCTL while the system is in auto suspend mode, a deadlock can happen. Specifically, the query path holds a device lock (dev_lock) and then calls a function to resume the device (pm_runtime_resume_and_get()), which waits for the suspend operation to finish. Meanwhile, the suspend callback tries to acquire the same device lock, causing both processes to block each other and resulting in a deadlock.

The fix involves releasing the device lock before calling the resume function and reacquiring it afterward, as well as acquiring the device lock in the resume callback to maintain consistent locking.

Impact Analysis

This vulnerability can cause the system to deadlock during suspend and resume operations when certain queries are issued. This deadlock can lead to system hangs or freezes, potentially requiring a reboot and causing disruption of services or loss of data.

Mitigation Strategies

The vulnerability is fixed by updating the Linux kernel to a version where the deadlock issue in accel/amdxdna during suspend and resume is resolved.

Specifically, the fix involves releasing dev_lock before calling pm_runtime_resume_and_get() and reacquiring it after the call completes, as well as acquiring dev_lock in the resume callback to maintain consistent locking.

Therefore, the immediate mitigation step is to apply the kernel update that includes this fix.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-23295. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart